challeging session db/javascript Questio

[Anon]

I have a challenging session question:

How to stop user to open a 2nd browser window?
for example: if the user has open 1 netscape window to login. then he tries to open a 2nd netscape window to play arround. How can we test this?

I\'ve got some suggestions:

1. use javascript to close the second window.
2. use session and database to track the user.

I\'ve trying for some time. but haven\'t succeeded yet.

Any guru have done this before?

Thx

[factory21]

I haven't done this before, but my first approach would be to get the name of the target/window via javascript and pass it along to the php script for every request. Upon session initialization, it grabs it and stores it. Then, for each subsequent request, checks to see if they match, if not, output an error message.

Of course, there are some downsides to this: if the user closes the browser window they initially used, they won't be able to access your site until the session reinitizlizes. Either that or they'll have to use a different browser instance.

In the end, you should probably see if you can simply support multiple windows since most users will expect it.

[nashirak]

Just a simple thought. What if user has javascript tunred off or mabye Javascript isnt read right or supported in that browser. Never ever trust Javascript to be a fixme all for keeping people from doing something or keeping people out... there are plenty of ways around this and your user will figure this out. In the end it will only serve to frustrate him. 🙂
What Eric said in the end is right you will most likely have to use mulitiple window support.

Hope this Helps!

[Anon]

Since this is quite a task to handle on a general basis, you should try to support multiple session windows and tackle the problems arising from the multiple session windows one-by-one.

Usually the problem is that the session goes out of sync. I.e. the user opens another window and surfs somewhere in your system, then return to the original window to surf elsewhere --> the session doesn't know where the user is session-wise.

One way to handle this (without javascript) would be to allow multiple session windows and keep the critical session variables in the client page also. (Not the password of course! And it doesn't change during the session so it's not critical anyhow).

.samuli